5
Multi-Disciplinary Approach With a multi-Disciplinary approach you can explore important questions like: What motivates malicious acts on the web It’s not as simple as you might think How different motivations trigger different malicious behaviors The role of social networks In exploit diffusion In identifying malicious actors and attribution Predicting emerging threat scenarios

7
Malware and Hackers How do we identify the hackers who have the ability to build the new tools and materials, relative to the larger population of semi-skilled users? Where and how do they sit in larger social networks? Few systematic unclassified examinations of the malware and hacker community have examined social ties and interests

8
On-line Resources The malware and hacking community utilize on-line resources that can be actively mined for information to explore these questions. This study will examine the social networks of the malware and hacking community in Russia and Eastern Europe using data generated from social networking blogs Blogs provide important information on: Current and emerging threats The relationships and behavior of attackers Locations, attitudes, beliefs

9
Self-Report Information Each LJ profile allows users to provide information on their: Location Education Biographies sometimes provide useful information on psychological status of the user or whether the journal is friends-only Interests can include political affiliation, geographical location as well as nonsense Friends people whom the users read and who can have access to ‘friends-only’ entries Also friend of people who read this journal and do not have access to protected entries Mutual friends both users added each other Communities LJ groups that the individual belongs to

13
Extrapolating Data: Risk Risk scores were created and assigned based on open searches on the handle or forum name provided, along with additional detail 0: no risk 1: computer security blogger 2: low level hacker 3: high level hacker

19
The Process of Sales “You know me [contact me] in ICQ and obviously explain what I need to do... After that, as soon as I complete your order, you transfer money into my WebMoney purse. After that, you receive the product... To familiars (at least exchange couple of words in ICQ) I will give the product first. For all the rest, we work based on the scheme: money first, and then chairs after.”

24
24 Motivations in the Community - MEECES A play off the old FBI counter-intelligence term MICE MEECES Money Ego Entertainment Cause Entry to social group Status

25
25 Motivations: Money No news to anyone - now by far the most common motivator for blackhats Individuals motivated by money still often are found mostly within groups that share this motivation Emergence of “currencies” in use in the black hat community Stolen credit cards Stolen bank accounts Root ownership of compromised machines Exploits Virtual assets (QQ coins) “Secret” data

26
26 Motivations: Money Money has a powerful effect on social structure and social relations Money is fundamentally changing many elements within the hacking community Money also acts as a force to attract individuals who are outside the community Money as a social object gives these outsiders opportunities for power and prestige inside the hacking community that were formerly not available to them

27
27 Motivations: Ego Derived from the satisfaction that comes from overcoming technical obstacles and creating code that is elegant and innovative Idea of mastery over the machine – getting it to do what you want, often in spite of numerous security obstacles The community at large shares this common and very powerful motivation This core motivation still present and remains a strong social motivation within the community

28
28 Motivations: Entertainment This motivation arises from the consequences of an exploit Getting a device to do something unusual or novel Bluejack bluetooth devices like phones and get them to call porn lines Originally an uncommon motivation, it has gained momentum over the past years due in part to: Infusion of less technical individuals into the digital space Expanded social environment in the digital space

29
29 Motivations: Cause A rapidly evolving motivation in the hacking community Most common instance of this motivation – hacktivism: the use of the Internet to promote a particular political, scientific or social cause Original seed – “information should be free”

30
30 Motivations: Cause Recent examples of hacktivism Beginning in 2008 - project chanology, an attack on Scientology by Anonymous group 2008 – Chinese attacks on CNN in response to Western protests during Olympic Torch relay + accusations of biased media reports in the West 2009 – Efforts by groups to facilitate forums for online public protest by Iranians angered by Iranian election results 2009 -2010– Attacks on Australian government websites protesting the proposed filtering of Australian ISP traffic for “unsafe” materials on the Internet 2010 – current – Wikileaks disclosure of thousands of classified documents and diplomatic cables

31
31 Motivations: Cause There have been a significant increase in the instances of cause-motivated hacks over the past few years The seriousness and consequences of cause- motivated attacks has grown significantly Remember the phrase “civilian cyber warrior” – a special case of Cause we will return to a bit later…

32
32 Motivations: Entrance to a Social Group Hacking groups tend to be status homogeneous in nature This implies there is a certain level of expertise necessary for induction into the group Elegant code/exploits are one method for gaining acceptance into the group Seeing more of this motivation given shifts in traditional society’s perspective on hacking

33
33 Motivations: Status A powerful motivation within the hacking community Community as meritocracy Skills and expertise in networks, operating systems, hardware, security, etc. used as status characteristics Your position in the status hierarchy – locally and globally – depends in great part on these characteristics The decline of the hacking meritocracy Non-trivial decreases in basing status upon skills and expertise – probably due to the rise of money as a motivation

34
Near-Term Emerging Threats Civilian Cyber Warrior Hacking Groups Aggregating Different Forms of Power Loose Coupling of Virtual and Violent Criminal Activity Large Scale Collection of Information by Nation States for CI

36
36 The Special Case of the Civilian Cyber Warrior Traditional forms of aggression Personal costs Economic Probability of getting caught Legal consequences Historical and social significance of emergence of civilian cyber warrior Key point – the social psychological significance of the event First time in history that an individual could cost-effectively attack a nation state The reassessment of the usual assumptions of the inequalities of the levels of power between nation states and citizens – establishes new relationships between institutions of society, government and individuals

37
37 Different Social Dimensions Under Investigation as Related to Civilian Cyber Warrior Behavior Civilian Cyber Warrior study is concentrating on.. Dependent variables Willingness to commit acts of cyberterror against another country Willingness to commit acts of cyber terror against their own country Willingness to commit acts of physical terror against another country Willingness to commit acts of physical terror against their own country

38
38 Different Social Dimensions Under Investigation as Related to Civilian Cyber Warrior Behavior Civilian Cyber Warrior study is concentrating on.. Independent predictor variables including Level of skill Hours per week using computer Prior minor malicious acts using a computer Level of nationalism Level of ethnocentrism Country of orign Demographics

39
39 10) Imagine that the country of Bagaria has recently promoted national policies and taken physical actions that have had negative consequences to the country that you most closely associate as your home country or homeland. These policies and actions have also resulted in significant hardships for the people in your home country. What actions do you think would be appropriate for you to take against Bagaria given their policies and physical actions against your home country? You may choose as many actions as you think the situation warrants. In this scenario, you may assume that you have the necessary skills to carry out any of the actions below. Option# ResponsesResponse % Total responses 235100.00% Do nothing: let your country work it out on its own 8937.87% Write a letter to government of Bagaria protesting their actions 12653.62% Participate in a protest at an anti-Bagaria rally 13356.60% Travel to Bagaria and protest at their country’s capitol building 5623.83% Travel to Bagaria and confront a Bagarian senior government official about their policies 4720.00% Travel to Bagaria and sneak into a military base to write slogans on buildings and vehicles 31.28% Travel to Bagaria and physically damage an electrical power substation 62.55% Travel to Bagaria and damage a government building with an explosive device 20.85% Graph this questionraph this question Sneak peak at preliminary data – more data is coming …

40
40 11) Aside from physical activity, what on-line activities do you think would be appropriate for you to take against Bagaria given their policies and physical actions against your home country? You may choose as many actions as you think the situation warrants. In this scenario, you may assume that you have the necessary skills to carry out any of the actions below. Option# ResponsesResponse % Total responses 235100.00% Do nothing : let your country work it out on its own 8536.17% Post a comment on a social networking website like Facebook or Twitter that criticizes the Bagarian government 17775.32% Deface the personal website of an important Bagarian government official 2611.06% Deface an important official Bagarian government website 2410.21% Compromise the server of a Bagarian bank and withdraw money to give to the victims of their policies and actions 125.11% Search Bagarian government servers for secret papers that you might be able to use to embarrass the Bagarian government 208.51% Compromise one or more Bagarian military servers and make changes that might temporarily affect their military readiness 156.38% Compromise one of Bagaria’s regional power grids which results in a temporary power blackout in parts of Bagaria 62.55% Compromise a nuclear power plant system that results in a small release of radioactivity in Bagaria 10.43% Sneak peak at preliminary data – more data is coming …

42
42 Points to Hopefully Take Away… Understanding the nature of the relationship between people and technology may help you predict where the next threat vectors are going to emerge The elements of the hacking community social structure are still there, but in different form and distribution The motivations of the hacking community are still there but their form, shape and consequences have changed, often dramatically Constructing scenarios of emerging threats can help you anticipate and plan in a fast evolutionary threat environment

About project

Feedback

To ensure the functioning of the site, we use cookies. We share information about your activities on the site with our partners and Google partners: social networks and companies engaged in advertising and web analytics. For more information, see the Privacy Policy and Google Privacy &amp Terms.
Your consent to our cookies if you continue to use this website.